scanf format length fix (non exploitable?) from

Fabian Hugelshofer <hugelshofer2006@gmx.ch>

diff --git a/arp.c b/arp.c
index 4ee5c58..3dd7187 100644 (file)
--- a/arp.c
+++ b/arp.c
@@ -8,7 +8,7 @@
  *              NET-3 Networking Distribution for the LINUX operating
  *              system.
  *
- * Version:     $Id: arp.c,v 1.25 2005/12/04 02:57:15 ecki Exp $
+ * Version:     $Id: arp.c,v 1.26 2009/07/08 00:24:03 ecki Exp $
  *
  * Maintainer:  Bernd 'eckes' Eckenfels, <net-tools@lina.inka.de>
  *
@@ -564,7 +564,7 @@ static int arp_show(char *name)
        strcpy(dev, "-");
        /* Read the ARP cache entries. */
        for (; fgets(line, sizeof(line), fp);) {
-           num = sscanf(line, "%s 0x%x 0x%x %100s %100s %100s\n",
+           num = sscanf(line, "%s 0x%x 0x%x %99s %99s %99s\n",
                         ip, &type, &flags, hwa, mask, dev);
            if (num < 4)
                break;

diff --git a/lib/inet_gr.c b/lib/inet_gr.c
index d1e5efc..84d8406 100644 (file)
--- a/lib/inet_gr.c
+++ b/lib/inet_gr.c
@@ -1,5 +1,5 @@
 /*
-   $Id: inet_gr.c,v 1.13 2000/10/08 01:00:44 ecki Exp $
+   $Id: inet_gr.c,v 1.14 2009/07/08 00:24:03 ecki Exp $
 
    Modifications:
    1998-07-01 - Arnaldo Carvalho de Melo - GNU gettext instead of catgets
@@ -38,7 +38,7 @@ extern char *INET_sprintmask(struct sockaddr *sap, int numeric,
 
 int rprint_fib(int ext, int numeric)
 {
-    char buff[1024], iface[16], flags[64];
+    char buff[1024], iface[17], flags[64];
     char gate_addr[128], net_addr[128];
     char mask_addr[128];
     int num, iflags, metric, refcnt, use, mss, window, irtt;
@@ -69,18 +69,18 @@ int rprint_fib(int ext, int numeric)
 
     fmt = proc_gen_fmt(_PATH_PROCNET_ROUTE, 0, fp,
                       "Iface", "%16s",
-                      "Destination", "%128s",
-                      "Gateway", "%128s",
+                      "Destination", "%127s",
+                      "Gateway", "%127s",
                       "Flags", "%X",
                       "RefCnt", "%d",
                       "Use", "%d",
                       "Metric", "%d",
-                      "Mask", "%128s",
+                      "Mask", "%127s",
                       "MTU", "%d",
                       "Window", "%d",
                       "IRTT", "%d",
                       NULL);
-    /* "%16s %128s %128s %X %d %d %d %128s %d %d %d\n" */
+    /* "%16s %127s %127s %X %d %d %d %127s %d %d %d\n" */
 
     if (!fmt)
        return 1;
@@ -205,7 +205,7 @@ int rprint_fib(int ext, int numeric)
 
 int rprint_cache(int ext, int numeric)
 {
-    char buff[1024], iface[16], flags[64];
+    char buff[1024], iface[17], flags[64];
     char gate_addr[128], dest_addr[128], specdst[128];
     char src_addr[128];
     struct sockaddr snet;
@@ -269,20 +269,20 @@ int rprint_cache(int ext, int numeric)
 
       fmt = proc_gen_fmt(_PATH_PROCNET_RTCACHE, 0, fp,
                       "Iface", "%16s",
-                      "Destination", "%128s",
-                      "Gateway", "%128s",
+                      "Destination", "%127s",
+                      "Gateway", "%127s",
                       "Flags", "%X",
                       "RefCnt", "%d",
                       "Use", "%d",
                       "Metric", "%d",
-                      "Source", "%128s",
+                      "Source", "%127s",
                       "MTU", "%d",
                       "Window", "%d",
                       "IRTT", "%d",
                       "HH", "%d",
                       "ARP", "%d",
                       NULL);
-      /* "%16s %128s %128s %X %d %d %d %128s %d %d %d %d %d\n" */
+      /* "%16s %127s %127s %X %d %d %d %127s %d %d %d %d %d\n" */
     }
 
     if (format == 2) {
@@ -292,22 +292,22 @@ int rprint_cache(int ext, int numeric)
                 "MSS   Window irtt  TOS HHRef HHUptod     SpecDst\n"));
         fmt = proc_gen_fmt(_PATH_PROCNET_RTCACHE, 0, fp,
                       "Iface", "%16s",
-                      "Destination", "%128s",
-                      "Gateway", "%128s",
+                      "Destination", "%127s",
+                      "Gateway", "%127s",
                       "Flags", "%X",
                       "RefCnt", "%d",
                       "Use", "%d",
                       "Metric", "%d",
-                      "Source", "%128s",
+                      "Source", "%127s",
                       "MTU", "%d",
                       "Window", "%d",
                       "IRTT", "%d",
                       "TOS", "%d",
                       "HHRef", "%d",
                       "HHUptod", "%d",
-                      "SpecDst", "%128s",
+                      "SpecDst", "%127s",
                       NULL);
-      /* "%16s %128s %128s %X %d %d %d %128s %d %d %d %d %d %128s\n" */
+      /* "%16s %127s %127s %X %d %d %d %127s %d %d %d %d %d %127s\n" */
     }
 
 

diff --git a/lib/interface.c b/lib/interface.c
index be7017e..f6f8906 100644 (file)
--- a/lib/interface.c
+++ b/lib/interface.c
@@ -7,7 +7,7 @@
    8/2000  Andi Kleen make the list operations a bit more efficient.
    People are crazy enough to use thousands of aliases now.
 
-   $Id: interface.c,v 1.30 2005/08/23 22:46:51 ecki Exp $
+   $Id: interface.c,v 1.31 2009/07/08 00:24:03 ecki Exp $
  */
 
 #include "config.h"
@@ -666,7 +666,7 @@ void ife_print_long(struct interface *ptr)
 #endif
 #if HAVE_AFINET6
     FILE *f;
-    char addr6[40], devname[20];
+    char addr6[40], devname[21];
     struct sockaddr_in6 sap;
     int plen, scope, dad_status, if_idx;
     extern struct aftype inet6_aftype;

diff --git a/netstat.c b/netstat.c
index 1dca3b3..3085199 100644 (file)
--- a/netstat.c
+++ b/netstat.c
@@ -6,7 +6,7 @@
  *              NET-3 Networking Distribution for the LINUX operating
  *              system.
  *
- * Version:     $Id: netstat.c,v 1.62 2008/12/02 01:53:48 ecki Exp $
+ * Version:     $Id: netstat.c,v 1.63 2009/07/08 00:24:03 ecki Exp $
  *
  * Authors:     Fred Baumgarten, <dc6iq@insu1.etec.uni-karlsruhe.de>
  *              Fred N. van Kempen, <waltje@uwalt.nl.mugnet.org>
@@ -849,7 +849,7 @@ static void udp_do_one(int lnr, const char *line,const char *prot)
 
     more[0] = '\0';
     num = sscanf(line,
-                "%d: %64[0-9A-Fa-f]:%X %64[0-9A-Fa-f]:%X %X %lX:%lX %X:%lX %lX %d %d %lu %512s\n",
+                "%d: %64[0-9A-Fa-f]:%X %64[0-9A-Fa-f]:%X %X %lX:%lX %X:%lX %lX %d %d %lu %511s\n",
                 &d, local_addr, &local_port,
                 rem_addr, &rem_port, &state,
          &txq, &rxq, &timer_run, &time_len, &retr, &uid, &timeout, &inode, more);
@@ -995,7 +995,7 @@ static void raw_do_one(int lnr, const char *line,const char *prot)
 
     more[0] = '\0';
     num = sscanf(line,
-                "%d: %64[0-9A-Fa-f]:%X %64[0-9A-Fa-f]:%X %X %lX:%lX %X:%lX %lX %d %d %lu %512s\n",
+                "%d: %64[0-9A-Fa-f]:%X %64[0-9A-Fa-f]:%X %X %lX:%lX %X:%lX %lX %d %d %lu %511s\n",
                 &d, local_addr, &local_port, rem_addr, &rem_port, &state,
          &txq, &rxq, &timer_run, &time_len, &retr, &uid, &timeout, &inode, more);